Show Side Menu
To view, print or save our practice booklet, click here
Access Online Services
Call 111 - When it is less urgent than 999

Data Subject Access Request


In accordance with the General Data protection Regulation(GDPR), patients (data Subjects) have the right to access their data and any supplementary information held by Dr Malik Practice: this is commonly known as a data subject access request (DSAR). Dat subject have a right to receive:

  • Confirmation that there data is being processed
  • Access to their personal data
  • Access to any other supplementary information held about them

Ways to access

Best practice recommendation in the GDPR is that, organisations should be able to provide remote access to a secure self-service system which would provide the individual with the direct access to his or her information. Please contact us to apply for online services if you have not already done so. signing up to the practice secure online service will provide patients with the data held in their medical records such as demographic, allergies and sensitivities,  results, problems and diagnosis, procedures, ethnicity, medication, vaccinations.

In order to access on line services, Please download online access form and guidance from here 

Application form For Online access to my Medical Records

Patient Online Records access Patient information leaflet

You will need to return the completed paper copy of online form to the practice with identification before being granted access to your records.

Patients may request paper copies of their health records , request can be made by email to However patients may request access to their health records informally.

Data Subject Access Request Application form

Regardless of the preferred method of access, patients and authorised thirt parties must initially complete DSAR Form. In order for us to process and verify all requests from Data subjects, you must submit a Data Subject Access Request form. The DSAR form is available from the practice downloadable section or click here :  Application form for access to health records

Alternatively, a paper copy of DSAR is available from  reception. You will need to return the completed paper copy of DSAR form to the practice with Proof of Identity. We accept the following forms of identification: one of them should be photographic identification and one copy of Utility bill

  • UK Driving Licence
  • Current UK Passport
  • Birth Certificate
  • Utility Bill for supply of gas, electric, water or telephone.

Time Frame to respond to your DSAR

In accordance with the GDPR, patients are entitled to receive a response within the maximum given time of one calendar month from the date of submission of the DSAR.

Complex or multiple Requests

In the case of Complex or multiple requests, Dr Malik Practice will require more time to honor the request from Data Subject. In such situation we may extend the response time by a period of two months. The data subject will be in informed and reasons for the extension given in a timely manner with in one month.

Declining a Request

Where Dr Malik Practice decide to decline requests and not take any action on the request of data subject due to excessive, manifestly unfounded or repetitive requests. you will be informed of this decision without any delay and at the latest within one month of receipt of the request.


There may be occasions when data controller will withhold information kept in the health record, particularly if the disclosure of such information is likely to cause  undue stress or harm to you or any other person. Or when the record has the information relating to third party.

Free of Charge with Exceptions

Under the GDPR we are to provide copies of health records free of charge but with some exceptions.

If you don not have access to practice online services, we will provide a copy of the information free of charge, as per GDPR rules. However we may charge a 'reasonable fee' when a request is manifestly unfounded or excessive, particularly if it is repetitive.

We may also charge a reasonable fee to comply with requests for further copies of the same information. We understand that this does not mean that we can charge for all subsequent access requests.

Data Subjects and Third Party Requesting  access to records

Requests may or may not be received from the following:

Competent patients may apply for access to their own records or authorise third-party access to their records.

Children and Young People may also apply in the same manner as other competent patients and Dr Malik Practice will not automatically presume a child or young person has capacity under the age of 16. However, those aged 12 or over are expected to have the capacity to consent to medical information being disclosed.

Parents  may apply to access their child's health record so long as it is not in contradiction to the wishes of the competent child.

Individuals with a responsibility for adults who lack capacity are not automatically entitled to access the individual's health records. Dr.Malik Practice that the patient's capacity is judged in relation to a particular decisions being made. any considerations to nominate an authorised individual to make proxy decisions for an individual who lacks Capacity will comply with the Mental Capacity act in England and wales and the Adults with Incapacity Act Scotland.

Next Of Kin (NOK) have no rights of access to health records.

Police are not able to access health records without first obtaining a court order or warrant. However , health professionals at Dr Malik Practice may disclose relevant information to the police if the patient has consented or if there is overriding public interest.

Solicitors and insurance companies in most cases will provide the patient's signed consent to release information held in their record. Dr Malik practice will ensure that patients are fully aware of the information being provided to the solicitor who is acting for that patient. In the case of a solicitor requesting information, the BMA has provided the following template:

Dr Malik practice will ask solicitors to use the appropriate form when requesting information.

Deceased patients retain the right of confidentiality. There are number of considerations taken into account prior to disclosing the health record of a deceased patient. Such considerations are detailed in the Access to Health Records Act 1990. Under the terms of this Act, Dr Malik Practice will only grant access if you are either:

  • a personal representative (executor of the deceased person's estate)
  • someone who has a claim resulting from the death

The medical records of the deceased will be passed to Primary Care Support Team(PCSE) for storage . Dr Malik Practice can advise you who you need to contact in such instances. PCSE will retain the GP records of deceased patients for ten years, after which time they will be destroyed. PCSE have provided an application form which can be used to request copies of a deceased patient's record.

In the case of any third -party requests, Dr Malik practice will ensure that the patient has consented to the disclosure of this information by means of a valid signature of the patient.

Data Controller

Dr Malik Practice is the data controller. Should you have any questions relating to accessing your medical records, please ask to discuss this with The Practice Manager

Review: June 2019

Find a support worker role near you today
Local Services, Let